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DETAILED ACTION 

1 . Claims 1-27 are presented for examination. 

Priority 

2. Applicant's claim for domestic provisional priority under 35 U.S.C. 1 19(e) is 
acknowledged. Claims 1-27 do not benefit the provisional priority date as the effective filHng 
date. The provisional application does not contain all the claimed invention, for example, the 
detailed description of payload objects and event filters differs. 



Specification 

3. The following guidelines illustrate the preferred layout for the specification of a utility 
apphcation. These guidelines are suggested for the applicant's use. 



Arrangement of the Specification 

As provided in 37 CFR 1.77(b), the specification of a utility application should include 
the following sections in order. Each of the lettered items should appear in upper case, without 
underlining or bold type, as a section heading. If no text follows the section heading, the phrase 
"Not AppUcable" should follow the section heading: 

(a) TITLE OF THE INVENTION. 

(b) CROSS-REFERENCE TO RELATED APPLICATIONS. 

(c) STATEMENT REGARDING FEDERALLY SPONSORED RESEARCH OR 

DEVELOPMENT. 

(d) INCORPORATION-BY-REFERENCE OF MATERIAL SUBMITTED ON A 

COMPACT DISC (See 37 CFR 1.52(e)(5) and MPEP 608.05. Computer program 
listings (37 CFR 1.96(c)), "Sequence Listings" (37 CFR 1. 821(c)), and tables 
having more than 50 pages of text are permitted to be submitted on compact 
discs.) or 

REFERENCE TO A "MICROFICHE APPENDIX" (See MPEP § 608.05(a). 
"Microfiche Appendices" were accepted by the Office until March 1, 2001.) 

(e) BACKGROUND OF THE INVENTION. 
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(1) Field of the Invention. 

(2) Description of Related Art including information disclosed under 37 CFR 1.97 
and 1.98. 

(f) BRIEF SUMMARY OF THE INVENTION. 

(g) BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWING(S). 

(h) DETAILED DESCRIPTION OF THE INVENTION. 

(i) CLAIM OR CLAIMS (commencing on a separate sheet). 

(j) ABSTRACT OF THE DISCLOSURE (commencing on a separate sheet). 

(k) SEQUENCE LISTING (See MPEP § 2424 and 37 CFR 1.821-1.825. A "Sequence 
Listing" is required on paper if the application discloses a nucleotide or amino 
acid sequence as defined in 37 CFR 1.821(a) and if the required "Sequence 
Listing" is not submitted as an electronic document on compact disc). 

The disclosure is objected. Some of the informalities are: 

i. The section "CROSS-REFERENCE TO RELATED APPLICATIONS" is 
missing co-pending applications. 

ii. The "DETAILED DESCRIPTION OF THE INVENTION" section 
contains significant amount of prior art contents. All the known prior art 
contents from the "DETAILED DESCRIPTION OF THE INVENTION" section 
needs to be moved into the "Description of Related Art" sub-section of the 
"BACKGROUND OF THE INVENTION" section. 

iii. The "Description of Related Art" sub-section of the "BACKGROUND OF 
THE INVENTION" section must contain all the known prior art subject matter. 
This section does not provide any background information and rather provides 
information about the invention itself 

Appropriate correction is required. 



4. The title of the invention is not descriptive. A new title is required that is clearly 
indicative of the invention to which the claims are directed. 
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5. Applicant is reminded of the proper content of an abstract of the disclosure. 

A patent abstract is a concise statement of the technical disclosure of the patent and 
should include that which is new in the art to which the invention pertains. If the patent is of a 
basic nature, the entire technical disclosure may be new in the art, and the abstract should be 
directed to the entire disclosure. If the patent is in the nature of an improvement in an old 
apparatus, process, product, or composition, the abstract should include the technical disclosure 
of the improvement. In certain patents, particularly those for compounds and compositions, 
wherein the process for making and/or the use thereof are not obvious, the abstract should set 
forth a process for making and/or use thereof If the new technical disclosure involves 
modifications or alternatives, the abstract should mention by way of example the preferred 
modification or alternative. 

The abstract should not refer to purported merits or speculative applications of the 
invention and should not compare the invention with the prior art. 

Where applicable, the abstract should include the following: 

(1) if a machine or apparatus, its organization and operation; 

(2) if an article, its method of making; 

(3) if a chemical compound, its identity and use; 

(4) if a mixture, its ingredients; 

(5) if a process, the steps. 

Extensive mechanical and design details of apparatus should not be given. 

The abstract of the disclosure is objected to because it is missing key terms involved in 
the invention and is not properly understood. Abstract should contain computer terminology 
used in the invention, Uke, network, database, e-mail message, etc. Also the abstract does not 
clearly state the goal of the invention. Correction is required. See MPEP § 608.01(b). 



Drawings 

6. Figure 1 should be designated by a legend such as —Prior Art— because only that which is 
old is illustrated. See MPEP § 608.02(g). A proposed drawing correction or corrected drawings 
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are required in reply to the Office action to avoid abandonment of the application. The objection 
to the drawings will not be held in abeyance. 



Information Disclosure Statement 
7. Applicant and the assignee of this application are required under 37 CFR 1 . 105 to 
provide the following information that the examiner has determined is reasonably necessary to 
the examination of this application. Unless the invention is created from scratch, applicant needs 
to provide the prior arts that have led to the invention. 

In response to this requirement, please provide the title, citation and copy of each 
publication that is a source used for the description of the prior art in the disclosure. For each 
publication, please provide a concise explanation of that publication's contribution to the 
description of the prior art. 

This Office action has an attached requirement for information under 37 CFR 1 . 105. A 
complete reply to this Office action must include a complete reply to the attached requirement 
for information. The time period for reply to the attached requirement coincides with the time 
period for reply to this Office action. 



Claim Rejections - 35 USC§ 112 
The following is a quotation of the first paragraph of 35 U.S.C. 1 12: 

The specification shall contain a written description of the invention, and of the manner and process of making 
and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it 
pertains, or with which it is most nearly connected, to make and use the same and shall set forth the best mode 
contemplated by the inventor of carrying out his invention. 
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8. Claims 1-10 recite the term "first event filter" and "second event filter". There is 
insufficient antecedent basis for this limitation in the claim. 

9. Claims 11-15 recite the term "first format" and "second format". There is insufficient 
antecedent basis for this limitation in the claim. 

10. Claims 22-27 recite the term "first event" "first data format", "second event", "second 
data format". There is insufficient antecedent basis for this limitation in the claim. 

The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the 
subject matter which the applicant regards as his invention. 

11. Claims 1-10 are rejected under 35 U.S.C. 1 12, second paragraph, as being indefinite for 
failing to particularly point out and distinctly claim the subject matter which appUcant regards as 
the invention. 

The terms "filter criteria", "standard data format" and "payload" are a relative terms, 
which renders the claim indefinite. 

12. Claims 1 1-1 5 are rejected under 35 U.S.C. 1 12, second paragraph, as being indefinite for 
failing to particularly point out and distinctly claim the subject matter which applicant regards as 
the invention. 

The terms "a fist format", "a second format", "standard data format", "event payload", "a 
filter", "criteria" and "event header" are a relative terms, which renders the claim indefinite, 

13. Claims 16-21 are rejected under 35 U.S.C. 112, second paragraph, as being indefinite for 
failing to particularly point out and distinctly claim the subject matter which applicant regards as 
the invention. 
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The terms "event transformer", "event consumer", "standard data format" and "event 
payload" are a relative terms, which renders the claim indefinite. 

14. Claims 22-27 are rejected under 35 U.S.C. 1 12, second paragraph, as being indefinite for 
failing to particularly point out and distinctly claim the subject matter which applicant regards as 
the invention. 

The terms "a fist format", "a second format", "event action handler", "standard data 
format", "event payload", "filter criteria" and "event header" are a relative terms, which renders 
the claim indefinite. 

Claim Rejections - 35 USC §102 

15. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 

basis for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by another filed 
in the United States before the invention by the applicant for patent or (2) a patent granted on an application for 
patent by another filed in the United States before the invention by the applicant for patent, except that an 
international application filed under the treaty defined in section 35 1(a) shall have the effects for purposes of this 
subsection of an application filed in the United States only if the international application designated the United 
States and was published under Article 21(2) of such treaty in the English language. 

16. Claims 1-27 are rejected under 35 U.S.C. 102(e) as being anticipated by O'Brien et al. 
6,470,384 (Hereinafter O'Brien). 

17. As per claims 1, 10, 11, 15, 16 and 22, O'Brien teaches the following: 
a method comprising, 

one or more computer-readable media having stored thereon a computer program that, 
when ex ecuted by one or more processors, causes the one or more processors to. 
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an apparatus comprising: 

receiving a first event at a first event filter (e.g., an event generated by SNMP-capable 
agent is received by the SNMP Traps network event, col. 2, line 60 - col. 7, line 65), the first 
event filter having an associated filter criteria (e.g. an agent having a vendor-specific MIB to 
interpret specific SNMP traps, col. 2, line 60 - col. 6, line65), 

applying the filter criteria associated with the first event filter to the first event (e.g., a 
network event 7 could be either a standard SNMP trap 3 1 or a specialized trap or notification, 
such as a certogram 30. In addition, three types of event filters are used, Visual Basic scripts, 
fi-equency thresholds, and adding custom values to the event or action based on SNMP values 
before the trap is forwarded to an action 32. Other forms of network events, actions and event 
fihers are feasible as is known in the art, col. 5, lines 6 - 50), 

if the first event satisfies the filter criteria associated with the first event filter, then: 

transforming the first event into a second event (e.g., mapping of network events 7 to 
actions 32, col 5, line 6 - col. 6, line 65); and 

communicating the second event to a second event filter having an associated filter 
criteria (e.g., the arbiter 8 manages the receipt, analysis, and processing of network events 7 
based on user defined action sets 39. Each action set 39 defines mappings between actions 32 
and event filters 40. Actions 32 are performed by actors 9 and are described below. Event filters 
40 are actions which are performed after the receipt of a network event 7 but before any 
corresponding actions 32 are executed, col. 2, Une 61, col. 6, line 65), 

the second event filter being associated with an event consumer wherein the event 
consumer performs an action if the second event satisfies the filter criteria associated with the 
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second event filter (e.g., the actors 9 take actions in response to instructions from the arbiter 8. 
In the described embodiment, six types of actors are supported, a help desk 27, firewall 28, and 
methods for broadcasting a network message 33, sending an electronic mail message (email) 34, 
sending an alphanumeric page 35, and running a script 36. Other types of actors and actions are 
feasible. The methods could be performed by the same system as the manager 25 or by another 
remote system depending upon the definition of the action, col. 2, line 61, col. 6, line 65), 

receiving a first event having a first format (e.g., an agent having a vendor-specific MIB 
supplied with their hardware and other types of sensors may have unique mapping key formats, 
col 2, line 61, col. 6, line 65), 

transforming the first event into a second event having a second format (e.g., format of 
the events handled by the actions, figure 2, col. 2, line 61, col. 6, line 65), 

generating an event header having a plurality of parameters, wherein the plurality of 
parameters are arranged in a standard data format (e.g., tags used in figure 4, is a data structure 
showing a binary large object (BLOB) 60 storing an action set 32 for use in the manager 25, 
Using the BLOB 60, an action set 32 can embed one or more actions 32 and can reference one or 
more event filters 40. An action set 32 forms an association with one or more network events 7 
through scope, as the event mappings are stored in the database 26, including certogram 
mappings 48 and SNMP mappings 49, within an instance of an action set 32. Internally, each 
action set 32 stores the action set configuration 61, including any variables used by the action set 
62, and one or more streams 63a-c within which are stored the specifications for actions 32. 
Each stream 63a contains a stream identifier 64, Globally Unique Identifier (GUID) 65, name 66, 
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configuration 67, and any variables 68 used by the action. Also, if used, any filter identifiers 69 
are also stored in the BLOB 60, col 7, line 1, col. 10, line 43), 

generating an event payload having a plurality of payload objects wherein the plurality of 
payload objects identify at least one action to perform in response to the event (e.g., The arbiter 8 
manages the receipt, analysis, and processing of network events 7 based on user defined action 
sets 39. Each action set 39 defines mappings between actions 32 and event filters 40, col. 5, 
lines 35 - 60), 

an event transformer to receive a first event and transform the first event into a second 
event (e.g., network events receiving events fi-omthe agents and then generating events for the 
manager, col. 2, line 60 - col. 7, hne 65), the second event having a standard data format 
regardless of the first event data format (e.g., action set containing user defined actions, col. 2, 
line 60 - col. 7, line 65), 

a plurality of event filters coupled to the event transformer, the event filters to apply filter 
criteria to the second event (e.g., event filters and their associated action sets, figure 2), 

a plurality of event consumers coupled to the plurality of event filters (e.g., actions 
coupled with the manager and event filters, figure 2, col. 2, line 60 - col. 7, Une 65) and the 
event consumers to perform an action if the second event satisfies the filter criteria apphed by the 
event filters (e.g., actions 32, to create actions based on the events, figure 2, col 2, line 60 - col 
7, line 65), 

receive a first event having a first data format (e.g., receiving an event fi*om the agents 
having hardware dependent format, an agent have a copy of a vendor-specific MIB supplied with 
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their hardware, Other types of sensors may have unique mapping key formats, col 2, Hne 61, col. 
6, Hne 65), 

fiher the first event using a first filter criteria (e.g., an agent filtering using a vendor- 
specific MIB, col. 2, line 60 - col. 6, line65), 

transform the first event into a second event having a second data format if the first event 
satisfies the first filter criteria (e.g., mapping of network events 7 to actions 32, col. 5, line 6 - 
col. 6, line 65), wherein the second data format includes an event header having a plurality of 
parameters (e.g., internally, each action set 32 stores the action set configuration 61, including 
any variables used by the action set 62, and one or more streams 63a-c within which are stored 
the specifications for actions 32. Each stream 63a contains a stream identifier 64, Globally 
Unique Identifier (GUID) 65, name 66, configuration 67, and any variables 68 used by the 
action. Also, if used, any filter identifiers 69 are also stored in the BLOB 60, col. 7, line 1, col. 
10, line 43), and an event payload having a plurality of payload objects (e.g., manager and 
actions sets, event filters and actions, col. 2, line 60 - col. 7, line 65); and 

communicate the second event to an event action handler if the first event satisfies the 
first filter criteria (e.g., to send an e-mail by actions after manger receives events from network 
events, col. 2, line 60 - col. 7, line 65). 

18. As per claims 2-9, 12-14, 17-21 and 23-27, O'Brien teaches the following: 

the second event includes a header having a plurality of parameters wherein the event 
header has a standard data format regardless of event source (e.g., a data structure showing a 
binary large object (BLOB) 60 storing an action set 32 for use in the manager 25 of the system of 
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FIG. 1 . Using the BLOB 60, an action set 32 can embed one or more actions 32 and can 
reference one or more event filters 40. An action set 32 forms an association with one or more 
network events 7 through scope, as the event mappings are stored in the database 26, including 
certogram mappings 48 and SNMP mappings 49, within an instance of an action set 32. 
Intemally, each action set 32 stores the action set configuration 61, including any variables used 
by the action set 62, and one or more streams 63a-c within which are stored the specifications for 
actions 32. Each stream 63a contains a stream identifier 64, Globally Unique Identifier (GUTD) 
65, name 66, configuration 67, and any variables 68 used by the action. Also, if used, any filter 
identifiers 69 are also stored in the BLOB 60, col. 7, line 1, col. 10, line 43), 

the second event includes a pay load including a plurality of payload objects, wherein the 
plurality of payload objects identify at least one action to perform in response to the event (e.g., 
manager and actions sets, event filters and actions, action blocks determining and sending out 
user defined events, col. 2, line 60 - col. 7, line 65), 

the second event filter has no knowledge of the first event (e.g., independent network 
events, manager and event filters, col. 2, line 60 - col. 7, line 65), 

communicating the second event to a second event filter further comprises 
communicating the second event to a plurality of event filters (e.g., events sent to the event 
filters by the network elements, col. 2, line 60 - col. 7, line 65), each of the plurality of event 
filters having an associated filter criteria (e.g., event filters must be configured in a manner 
analogous to actions before being assigned to an action set. Configured filters are stored as 
BLOBs 60 in a global table, col. 10, lines 8 - 42), 
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each of the plurality of event filters being associated with one of a plurality of event 
consumers (e.g., event filters for different actions, figure 2), wherein each of the plurality of 
event consumers performs an action if the second event satisfies the filter criteria associated with 
the corresponding event filter (e.g., different actions blocks 32 performing different actions, 
figure 2). 

the action performed by the event consumer if the second event satisfies the filter criteria 
associated with the second event fiUer is logging the second event to a storage device (e.g., usage 
of storage manager and database, figure 3). 

the action performed by the event consumer if the second event satisfies the fiher criteria 
associated with the second event filter is forwarding the second event to a destination (e.g., 
broadcast network message action, figure 3), 

the action performed by the event consumer if the second event satisfies the filter criteria 
associated with the second event filter is generating an email message (e.g., send e-mail action, 
figure 3), 

applying the plurality of parameters in the event header to a fiher to determine whether 
the associated event meets criteria associated with the filter, the second event includes an event 
header having a plurality of parameters arranged in a standard data format, and wherein the 
plurality of parameters in the event header are applied to the event filters to determine whether 
the associated event satisfies the fiher criteria (e.g., a data structure showing a binary large object 
(BLOB) 60 storing an action set 32 for use in the manager 25, Using the BLOB 60, an action set 
32 can embed one or more actions 32 and can reference one or more event filters 40. An action 
set 32 forms an association with one or more network events 7 through scope, as the event 
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mappings are stored in the database 26, including certogram mappings 48 and SNMP mappings 
49, within an instance of an action set 32. Internally, each action set 32 stores the action set 
configuration 61, including any variables used by the action set 62, and one or more streams 63a- 
c within which are stored the specifications for actions 32. Each stream 63a contains a stream 
identifier 64, Globally Unique Identifier (GUID) 65, name 66, configuration 67, and any 
variables 68 used by the action. Also, if used, any filter identifiers 69 are also stored in the 
BLOB 60, col. 7, line 1, col. 10, line 43), 

the plurality of parameters are arranged in a standard data format regardless of the first 
event source, applying the second event to an event filter having an associated filter criteria; and 
communicating the second event to an event consumer if the second event satisfies the filter 
criteria associated with the event filter (e.g., In response to the receipt of the network event 
notification, the manager 25 determines the action set 39 to which the network event 7 is 
associated using a stored set of event mappings. Each of these action sets 39 group one or more 
actions 32 and one or more optional event filters 40. If appropriate, the manager 25 causes an 
actor 9 to perform some task by dispatching an appropriate action 32, col. 3, line 61, col. 10, line 

41), 

the event transformer operates independently of the event filters and independently of the 
event consumers (e.g., manager independent of the event filters and the actions, figure 2), 

the plurality of payload objects in the event payload are used by an event consumer (e.g., 
action blocks, figure 2) that receives the second event to identify an action to perform in 
response to the second event (e.g., action blocks to perform actions, to send e-mail, user 
notification etc., figure 2), 



if 
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the event action handler performs at least one action in response to the second event (e.g., 
action blocks to perform actions, to send e-mail, user notification etc., figure 2). 

Claim Rejections - 35 USC § 102 

1 9. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public use or on 
sale in this country, more than one year prior to the date of application for patent in the United States. 

20. Claims 1, 10, 1 1, 15, 16 and 22 re rejected under 35 U.S.C, 102(b) as being anticipated 
by Wold et. al. 5,724,589 (Hereinafter Wold). 

21. As per claims 1, 10, 1 1, 15, 16 and 22, Wold teaches the following: 
a method comprising, 

one or more computer-readable media having stored thereon a computer program that, 
when ex ecuted by one or more processors, causes the one or more processors to, 
an apparatus comprising: 

receiving a first event at a first event filter (e.g., event sink, col. 9, line 36 - col. 10, line 
21 ), the first event filter having an associated filter criteria (e.g., even sink handling event, col. 
9, line 36 -col. 10, line 21) 

applying the filter criteria associated with the first event filter to the first event (e.g., even 
sink handling event, col. 9, line 36 - col. 10, line 21), 



Application/Control Number: 09/875,245 Page 16 

Art Unit: 2126 

transforming the first event into a second event (e.g., transfer from one event to another 
event in an event chain, col. 9, line 36 - col. 10, line 21) 

communicating the second event to a second event filter having an associated filter 
criteria (e.g., even sink handling event, col. 9, line 36 - col. 10, line 21) 

the second event filter being associated with an event consumer v/herein the event 
consumer performs an action if the second event satisfies the filter criteria associated with the 
second event filter (e.g., any object oriented event that can be handled by the event filter in the 
event chain, (e.g., col 9, line 36 - col. 10, line 21), 

receiving a first event having a first format (e.g., with the requirement that the event 
source does not need to know the class of the event sink. As a result, the system allows 
developers to create C-h- software components which can be connected together without the 
components having to know anything about the makeup of the component to which it is 
connected, abstract), 

transforming the first event into a second event having a second format (e.g., transfer 
fi-om one event to another event in an event chain, col 9, line 36 - col. 10, line 21), 

generating an event header having a plurality of parameters, wherein the plurality of 
parameters are arranged in a standard data format (e.g., usage of object oriented terms and 
programming, macro with parameters, col. 11, line 15 - col 23, line 49), 

generating an event payload having a plurality of payload objects wherein the plurality of 
payload objects identify at least one action to perform in response to the event (e.g., sink object 
to handle the event, col 9, line 36 - col. 10, line 21, abstract), 
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an event transformer to receive a first event and transform the first event into a second 
event (e.g., transfer from one event to another event in an event chain, col 9, Hne 36 - col 10, 
line 21),), 

a plurality of event filters coupled to the event transformer, the event filters to apply fiher 
criteria to the second event (e.g., transfer from one event to another event in an event chain, col. 
9, Hne 36 -col. 10, line 21), 

a plurality of event consumers coupled to the plurality of event filters (e.g., event sink of 
the event chain filters) and the event consumers to perform an action if the second event satisfies 
the filter criteria applied by the event filters (e.g., action performed by the event sink in an event 
chain, col. 9, line 36 - col. 10, line 21), 

receive a first event having a first data format, filter the first event using a first filter 
criteria, transform the first event into a second event having a second data format if the first 
event satisfies the fu-st filter criteria, communicate the second event to an event action handler if 
the first event satisfies the first filter criteria (e.g., Despite the absence of any C-H- language 
support for events, the present invention provides a type-safe *'wiring" mechanism—one using 
standard C-H- to dispatch an event, raised by one object (the '*event source"), to a method of 
another object (the "event sink"), with the requirement that the event source does not need to 
know the class of the event sink. As a result, the system allows developers to create 0++ 
software components which can be connected together without the components having to know 
anything about the makeup of the component to which it is connected. Thus, developers can 
create pre-packaged, re-usable software components which can simply be "plugged into" a 
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design— all accomplished within the confines of the standard C-H- programming language, 
abstract). 

Conclusion 

22. Examiner has found numerous arts related to the disclosed subject matter. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Haresh Patel whose telephone number is (703) 605-5234. The 
examiner can normally be reached on Monday, Tuesday, Thursday and Friday from 10:00 am to 
8:00 pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, John FoUansbee, can be reached at (703) 305-8498. 

The appropriate fax phone number for the organization where this application or 
proceeding is assigned is (703) 306-5404. 

Any inquiry of a general nature or relating to the status of this application or proceeding 
should be directed to the receptionist whose telephone number is (703) 305-3900. 



Haresh Patel 
November 12, 2003. 
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